---
 ChangeLog                          |   28 ++++++++++++++++++++++++++++
 include/freetype/config/ftstdlib.h |   10 ++++++----
 src/base/ftbitmap.c                |    4 ++++
 src/cid/cidload.c                  |   21 +++++++++++++++++++--
 src/psaux/t1decode.c               |    7 +++++++
 src/raster/ftrend1.c               |    7 +++++++
 src/truetype/ttgxvar.c             |    3 +++
 7 files changed, 74 insertions(+), 6 deletions(-)

Index: freetype-2.3.7/include/freetype/config/ftstdlib.h
===================================================================
--- freetype-2.3.7.orig/include/freetype/config/ftstdlib.h
+++ freetype-2.3.7/include/freetype/config/ftstdlib.h
@@ -63,14 +63,16 @@
   /**********************************************************************/
 
 
 #include <limits.h>
 
-#define FT_CHAR_BIT   CHAR_BIT
-#define FT_INT_MAX    INT_MAX
-#define FT_UINT_MAX   UINT_MAX
-#define FT_ULONG_MAX  ULONG_MAX
+#define FT_CHAR_BIT    CHAR_BIT
+#define FT_USHORT_MAX  USHRT_MAX
+#define FT_INT_MAX     INT_MAX
+#define FT_INT_MIN     INT_MIN
+#define FT_UINT_MAX    UINT_MAX
+#define FT_ULONG_MAX   ULONG_MAX
 
 
   /**********************************************************************/
   /*                                                                    */
   /*                 character and string processing                    */
Index: freetype-2.3.7/src/truetype/ttgxvar.c
===================================================================
--- freetype-2.3.7.orig/src/truetype/ttgxvar.c
+++ freetype-2.3.7/src/truetype/ttgxvar.c
@@ -1470,10 +1470,13 @@
 
       else
       {
         for ( j = 0; j < point_count; ++j )
         {
+          if ( localpoints[j] >= n_points )
+            continue;
+
           delta_xy[localpoints[j]].x += FT_MulFix( deltas_x[j], apply );
           delta_xy[localpoints[j]].y += FT_MulFix( deltas_y[j], apply );
         }
       }
 
Index: freetype-2.3.7/src/psaux/t1decode.c
===================================================================
--- freetype-2.3.7.orig/src/psaux/t1decode.c
+++ freetype-2.3.7/src/psaux/t1decode.c
@@ -660,10 +660,17 @@
             FT_Int  idx;
 
 
             if ( arg_cnt != 0 )
               goto Unexpected_OtherSubr;
+ 
+            if ( decoder->flex_state == 0 )
+            {
+              FT_ERROR(( "t1_decoder_parse_charstrings:"
+                         " missing flex start\n" ));
+              goto Syntax_Error;
+            }
 
             /* note that we should not add a point for index 0; */
             /* this will move our current position to the flex  */
             /* point without adding any point to the outline    */
             idx = decoder->num_flex_vectors++;
Index: freetype-2.3.7/src/cid/cidload.c
===================================================================
--- freetype-2.3.7.orig/src/cid/cidload.c
+++ freetype-2.3.7/src/cid/cidload.c
@@ -104,11 +104,11 @@
     default:
       {
         CID_FaceDict  dict;
 
 
-        if ( parser->num_dict < 0 )
+        if ( parser->num_dict < 0 || parser->num_dict >= cid->num_dicts )
         {
           FT_ERROR(( "cid_load_keyword: invalid use of `%s'!\n",
                      keyword->ident ));
           error = CID_Err_Syntax_Error;
           goto Exit;
@@ -152,11 +152,11 @@
     FT_Face       root = (FT_Face)&face->root;
     FT_Fixed      temp[6];
     FT_Fixed      temp_scale;
 
 
-    if ( parser->num_dict >= 0 )
+    if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
     {
       dict   = face->cid.font_dicts + parser->num_dict;
       matrix = &dict->font_matrix;
       offset = &dict->font_offset;
 
@@ -382,16 +382,28 @@
       FT_Int        lenIV = dict->private_dict.lenIV;
       FT_UInt       count, num_subrs = dict->num_subrs;
       FT_ULong      data_len;
       FT_Byte*      p;
 
+ 
+      /* Check for possible overflow. */
+      if ( num_subrs == FT_UINT_MAX )
+      {
+        error = CID_Err_Syntax_Error;
+        goto Fail;
+      }
 
       /* reallocate offsets array if needed */
       if ( num_subrs + 1 > max_offsets )
       {
         FT_UInt  new_max = FT_PAD_CEIL( num_subrs + 1, 4 );
 
+        if ( new_max <= max_offsets )
+        {
+          error = CID_Err_Syntax_Error;
+          goto Fail;
+        }
 
         if ( FT_RENEW_ARRAY( offsets, max_offsets, new_max ) )
           goto Fail;
 
         max_offsets = new_max;
@@ -406,10 +418,15 @@
       for ( count = 0; count <= num_subrs; count++ )
         offsets[count] = cid_get_offset( &p, (FT_Byte)dict->sd_bytes );
 
       FT_FRAME_EXIT();
 
+      /* offsets must be ordered */
+      for ( count = 1; count <= num_subrs; count++ )
+        if ( offsets[count - 1] > offsets[count] )
+          goto Fail;
+
       /* now, compute the size of subrs charstrings, */
       /* allocate, and read them                     */
       data_len = offsets[num_subrs] - offsets[0];
 
       if ( FT_NEW_ARRAY( subr->code, num_subrs + 1 ) ||
Index: freetype-2.3.7/src/base/ftbitmap.c
===================================================================
--- freetype-2.3.7.orig/src/base/ftbitmap.c
+++ freetype-2.3.7/src/base/ftbitmap.c
@@ -409,10 +409,14 @@
             pad = alignment - pad;
         }
 
         target->pitch = source->width + pad;
 
+        if ( target->pitch > 0                           &&
+             target->rows > FT_ULONG_MAX / target->pitch )
+          return FT_Err_Invalid_Argument;
+
         if ( target->rows * target->pitch > old_size             &&
              FT_QREALLOC( target->buffer,
                           old_size, target->rows * target->pitch ) )
           return error;
       }
Index: freetype-2.3.7/src/raster/ftrend1.c
===================================================================
--- freetype-2.3.7.orig/src/raster/ftrend1.c
+++ freetype-2.3.7/src/raster/ftrend1.c
@@ -145,10 +145,17 @@
     cbox.xMax = FT_PIX_CEIL( cbox.xMax );
     cbox.yMax = FT_PIX_CEIL( cbox.yMax );
 
     width  = (FT_UInt)( ( cbox.xMax - cbox.xMin ) >> 6 );
     height = (FT_UInt)( ( cbox.yMax - cbox.yMin ) >> 6 );
+
+    if ( width > FT_USHORT_MAX || height > FT_USHORT_MAX )
+    {
+      error = Raster_Err_Invalid_Argument;
+      goto Exit;
+    }
+
     bitmap = &slot->bitmap;
     memory = render->root.memory;
 
     /* release old bitmap buffer */
     if ( slot->internal->flags & FT_GLYPH_OWN_BITMAP )
Index: freetype-2.3.7/ChangeLog
===================================================================
--- freetype-2.3.7.orig/ChangeLog
+++ freetype-2.3.7/ChangeLog
@@ -1,5 +1,33 @@
+2011-11-08  Braden Thomas  <bthomas@apple.com>
+
+	[cid] Various loading fixes.
+
+	* src/cid/cidload.c (cid_load_keyword) <default>,
+	(parse_font_matrix, parse_expansion_factor): Correctly check number
+	of dictionaries.
+	(cid_read_subrs): Protect against invalid values of `num_subrs'.
+	Assure that the elements of the `offsets' array are ascending.
+
+2011-10-01  Braden Thomas  <bthomas@apple.com>
+
+	Handle some border cases.
+
+	* include/freetype/config/ftstdlib.h (FT_USHORT_MAX): New macro.
+
+	* src/base/ftbitmap.c (FT_Bitmap_Convert): Protect against invalid
+	value of `target->rows'.
+
+	* src/psaux/t1decode.c (t1_decoder_parse_charstrings): Add check for
+	flex start.
+
+	* src/raster/ftrend1.c (ft_raster1_render): Check `width' and
+	`height'.
+
+	* src/truetype/ttgxvar.c (TT_Vary_Get_Glyph_Deltas): Protect against
+	invalid values in `localpoints' array.
+
 2008-06-29  Werner Lemberg  <wl@gnu.org>
 
 	* Version 2.3.7 released.
 	=========================
 
